What could cause my bash history to be cleared unexpectedly?

Question

Today I noticed that my bash history is cleared completely. I have neither executed history -c nor deleted the .bash_history file. Apart from deleting the .bash_history file and history -c, how can bash history be cleared?

Answer 1

When closing multiple bash instances at the same time, there is a known race condition that may cause the history to be cleared. This occurs because there is no locking used when the bash history file is written.

Chet Ramey (the current bash maintainer) gave a good summary of the conditions for this issue:

The current (bash-4.3-devel) code works something like this, assuming no errors (lib/readline/histfile.c:history_do_write()):

• rename (histfile, histfile~)
• open file with O_CREAT|O_TRUNC
• malloc buffer large enough to hold all history data
• write all of the history entries in one write(2) call
• close file
• unlink (histfile~)

The bash-4.2 code works the same way except that it does not back up the history file. Each shell does the same thing when it exits, assuming histappend is not set, as in your configuration.

There are a couple of ways the history file can end up zero-length: the malloc can fail, or the write can fail. In bash-4.2, it's too late to do anything about the truncated history file at that point. In bash-4.3, the previous history file will be restored.

This mailing list thread from bug-bash contains a decent discussion of the problems, possible solutions, and concerns surrounding this.

There are also some other possibilities:

• At some point, your HISTSIZE or HISTFILESIZE was set to 0
• At some point, your readline history-size was set to 0
• Someone, whether intentionally or unintentionally, wiped the bash history (via > "$HISTFILE" or similar)

In the latter case, you might want to check that someone hasn't been accessing your account and is trying to hide their tracks in a crude way. Take a look at last, /var/log/auth (or /var/log/secure on CentOS/RHEL), and if you have it, any process accounting and/or auditing software you may have installed.

Answer 2

How I accidentally deleted my bash history:

I was rolling my own alternative terminal readline script from first principles: https://tiswww.cwru.edu/php/chet/readline/rluserman.html

and then testing it out in a terminal. That GNU Readline has a history size and history preservation instructions built in, so hist size can be defaulted, and thus all your history is blown away.

Recovery of history if left in memory:

If you catch it before a reboot, or if a terminal was left open from before the clear, you might be able to find your history in memory. Run history | cut -c 8- > histback_user1.txt on all terminals left open and for every user. If that produces a file with your extended history, then you can replace ~/.bash_history with histback_user1.txt. Also check the history of all users recently logged into the system as well as root's history. It's easy to accidentally clear the bash history under many circumstances, so if you want to be sure of no loss of history, you need a daily backup script.